CVE-2026-102828: simple-git_project simple-git OS Command Injection

Vulnerability summary

CVE-2026-102828 is a critical (CVSS 9.8) OS Command Injection vulnerability in simple-git_project simple-git. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 30-09-2026
   Last modifiedVulnerability information updated.

Description

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
• CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.